Blue Screen error IRQL_GT_ZERO_AT_SYSTEM_SERVICE

[ziaboga]

Hi friends from time to time my computer shutdown with a blue screen while I¨m working in my PC.
I did a memtest, hard test and all and my drivers are updated.
This was probably caused by the following module: ntoskrnl.exe (nt+0x76E80)
Bugcheck code: 0x4A (0x7798132A, 0x2, 0x0, 0xFFFFF88018107B60)
Error: IRQL_GT_ZERO_AT_SYSTEM_SERVICE
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a thread is returning to user mode from a system call when its IRQL is still above PASSIVE_LEVEL.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.

could you help me?
Thanks

 

[koolkat77]

Welcome.

BitDefender is a cause of BSOD's. Please remove it.

Microsoft (R) Windows Debugger Version 6.3.9600.16384 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\YUSRA\Downloads\Compressed\ZIABOGA-PC-29_01_2015_130613,63\012915-3276-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18700.amd64fre.win7sp1_gdr.141211-1742
Machine Name:
Kernel base = 0xfffff800`02202000 PsLoadedModuleList = 0xfffff800`02445890
Debug session time: Thu Jan 29 16:26:56.544 2015 (UTC + 6:00)
System Uptime: 0 days 1:10:29.434
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4A, {7798132a, 2, 0, fffff88018107b60}

Probably caused by : ntkrnlmp.exe ( nt!KiSystemServiceExit+245 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_GT_ZERO_AT_SYSTEM_SERVICE (4a)
Returning to usermode from a system call at an IRQL > PASSIVE_LEVEL.
Arguments:
Arg1: 000000007798132a, Address of system function (system call routine)
Arg2: 0000000000000002, Current IRQL
Arg3: 0000000000000000, 0
Arg4: fffff88018107b60, 0

Debugging Details:
------------------


PROCESS_NAME:  vsserv.exe

BUGCHECK_STR:  RAISED_IRQL_FAULT

FAULTING_IP: 
+641129873909359
00000000`7798132a ??              ???

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

CURRENT_IRQL:  2

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) x86fre

LAST_CONTROL_TRANSFER:  from fffff80002278429 to fffff80002278e80

STACK_TEXT:  
fffff880`18107928 fffff800`02278429 : 00000000`0000004a 00000000`7798132a 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`18107930 fffff800`02278360 : 00000000`00000c20 fffff880`18107b60 00000000`00000000 fffff800`02562513 : nt!KiBugCheckDispatch+0x69
fffff880`18107a70 00000000`7798132a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x245
00000000`23fdfcc8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7798132a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiSystemServiceExit+245
fffff800`02278360 4883ec50        sub     rsp,50h

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiSystemServiceExit+245

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  548a6e28

IMAGE_VERSION:  6.1.7601.18700

FAILURE_BUCKET_ID:  X64_RAISED_IRQL_FAULT_vsserv.exe_nt!KiSystemServiceExit+245

BUCKET_ID:  X64_RAISED_IRQL_FAULT_vsserv.exe_nt!KiSystemServiceExit+245

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_raised_irql_fault_vsserv.exe_nt!kisystemserviceexit+245

FAILURE_ID_HASH:  {7e9f2f5a-c8f7-350e-d3b5-490f9ba5e969}

Followup: MachineOwner
---------

Microsoft Security Essentials is recommended from a strict BSOD perspective, compatibility & stability compared to other internet security software. Malwarebytes is a great combo to MSE. They are free and lightweight.

Also uninstall your existing Antivirus software before you install MSE.

http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

   Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

 Clean boot

• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Reduce items at start-up. No software except anti-virus is required plus doing this improves the time for logging into windows:

• How to Change, Add, or Remove Startup Programs in Windows 7

Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:

• Click on the rb:
• Type CMD on Search
• Left click and Run as Administrator
• Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Temp Monitoring

Check for heating issues using Speccy or HWMonitor.

• Speccy - System Information - Free Download
• HWMonitor CPUID - System & hardware benchmark, monitoring, reporting

Upload a screen shot with either of the tools: http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

 

[ziaboga]

hi friends, I unistalled bitdefender and then installed MSE and Malwarebytes antimalware.I used all tools you told me and now I have to wait for a time to see if a new blue scrren appears.
Thanks for all.